Suppose a hacker got my BW credentials

You are right, 2FA won’t protect against keylogging. But it will always mitigate the consequences, no matter how an attacker is able to get your credentials.

Imagine your antivirus doesn’t (yet) detect the malware used. Imagine a sophisticated attacker uses legitimate remote administration tools to compromise your device. Imagine somebody is successfully watching you enter your password, e.g. using video surveillance.

In every scenario, the attacker only needs one thing to access all your passwords: your static credentials.

2FA adds a dynamic and separate component into this. Even if an attacker is able to login, he won’t get access to your account since he is missing the 2nd factor. Additionally, Bitwarden will send an email stating that somebody tried to access your vault from an unknown device, so you know you have been compromised.

Personally, I’m just using an OTP generator on my smartphone for new logins. If somebody tried to access my Bitwarden vault, both knowledge of my (long and secure, but easily remembered) password and access to my smartphone would be necessary.

1 Like